On 09/10/2026 13:01, [email protected] wrote: > Thank you for your contribution! Sashiko AI review found 4 potential issue(s) > to consider: > - [High] btf: memory corruption and invalid string offsets with split base BTF > - [High] bpf: heap buffer overflow in btf_relocate_map_distilled_base() on > split BTF > - [Medium] libbpf: NULL pointer dereference in btf_relocate() when btf has no > base > - [Low] bpf: btf_relocate_rewrite_strs prints empty string in warning > -- > > commit 5e8ac630aea03f4aa4b3a237792c60ad3c7a0956 > Author: Alan Maguire <[email protected]> > > btf: Preserve string relocation maps for split BTF > > Make btf_relocate() optionally return the string-offset map it builds > while relocating a BTF relative to a distilled base. A subsequent split > BTF object can use that map to rebase references to base strings. > > Also account for the accumulated base string offset when assigning a > new BTF base. This is required when the base is itself split. > >> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c >> index 592b71a838410..22dd123450c3e 100644 >> --- a/kernel/bpf/btf.c >> +++ b/kernel/bpf/btf.c >> @@ -1936,7 +1936,7 @@ void btf_set_base_btf(struct btf *btf, const struct >> btf *base_btf) >> { >> btf->base_btf = (struct btf *)base_btf; >> btf->start_id = btf_nr_types(base_btf); >> - btf->start_str_off = base_btf->hdr.str_len; >> + btf->start_str_off = base_btf->start_str_off + base_btf->hdr.str_len; >> } > > [Severity: High] > Since this allows using a split BTF as the base, will it cause out-of-bounds > heap writes in tools/lib/bpf/btf_relocate.c:btf_relocate_map_distilled_base()? >
It is technically true that if we used split BTF as the basis for a distilled .BTF.base, the string offset would be a problem. However we never do. The reason .BTF.base exists is because we want a way to create stable base BTF references for split BTF after potential base vmlinux changes.
